CVE-2026-87919: WooCommerce XML Feed Manager Privilege Escalation

CVE-2026-87919 Overview

CVE-2026-87919 affects the Product XML Feed Manager for WooCommerce WordPress plugin in versions prior to 3.1.1. The plugin's product shortcode fails to restrict which object methods it may invoke. It also does not verify the user's capability over the targeted product. Contributor-level users can delete arbitrary WooCommerce products by previewing a post that contains a crafted shortcode. The flaw is classified as Missing Authorization [CWE-862].

Critical Impact
Authenticated contributors can destroy WooCommerce catalog data, disrupting store operations and inventory integrity.

Affected Products

Product XML Feed Manager for WooCommerce WordPress plugin versions before 3.1.1
WordPress sites running WooCommerce with the vulnerable plugin installed
Any WooCommerce store granting contributor-level or higher accounts

Discovery Timeline

2026-09-12 - CVE-2026-87919 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-87919

Vulnerability Analysis

The Product XML Feed Manager for WooCommerce plugin exposes a shortcode that renders product data by invoking methods on a product object. The shortcode implementation does not validate the requested method name against an allowlist. It also skips capability checks (current_user_can) for the product being acted upon. When a contributor previews a post containing the shortcode, WordPress executes the shortcode in the context of the previewing user. This lets the shortcode call destructive methods such as those that delete or trash products.

The outcome is integrity loss for the WooCommerce catalog. An attacker who already holds a low-privilege account can remove product listings without triggering the standard administrative workflow.

Root Cause

The root cause is Missing Authorization [CWE-862]. The shortcode handler treats a user-supplied method name as trusted input and calls it on the product object. No allowlist limits which methods may run, and no permission check confirms the caller has authority to modify the referenced product.

Attack Vector

Exploitation requires an authenticated account at contributor level or above. The attacker creates a draft post embedding the vulnerable shortcode with parameters targeting a product ID and a destructive method. Requesting the post preview causes WordPress to render the shortcode and invoke the method. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-87919

Indicators of Compromise

Unexpected WooCommerce product deletions or products moved to trash outside normal admin workflows
Draft or preview requests from contributor-level accounts containing the plugin's product shortcode with unusual method parameters
WordPress audit-log entries showing product state changes attributed to non-administrator users

Detection Strategies

Inspect posts and post revisions for shortcode syntax referencing the Product XML Feed Manager plugin with method parameters that map to deletion or trashing
Correlate wp_posts changes for the product post type with the acting user ID, flagging modifications by contributor accounts
Alert on preview requests (preview=true query parameter) that trigger backend product mutations

Monitoring Recommendations

Enable a WordPress activity log plugin capturing post preview events and WooCommerce product lifecycle changes
Forward WordPress and web server logs to a centralized analytics platform for correlation across users, endpoints, and time windows
Baseline normal contributor behavior and flag deviations involving WooCommerce data mutations

How to Mitigate CVE-2026-87919

Immediate Actions Required

Update the Product XML Feed Manager for WooCommerce plugin to version 3.1.1 or later on all WordPress sites
Audit contributor, author, and editor accounts and remove any that are unnecessary or inactive
Review recent WooCommerce product deletions and restore items from backups if unauthorized removals are confirmed

Patch Information

The vendor addressed the issue in version 3.1.1 of the Product XML Feed Manager for WooCommerce plugin. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the Product XML Feed Manager for WooCommerce plugin until the patched version can be deployed
Restrict contributor-level accounts and require administrator review of drafts that embed plugin shortcodes
Apply a web application firewall rule that blocks preview requests containing the vulnerable shortcode with method parameters

bash

# Update the plugin using WP-CLI
wp plugin update woocommerce-product-xml-feeds --version=3.1.1

# Or deactivate as a temporary workaround
wp plugin deactivate woocommerce-product-xml-feeds